Notifications
Clear all
Topic starter
12/06/2026 12:04 am
TL;DR: Zero Trust programmes often stall after MFA and admin lockdown because only 16% of organisations cover most of their systems, users, and infrastructure, according to Gartner. A phased rollout creates a practical path from foundational controls to contextual access and operational scaling, but it only works when teams treat Zero Trust as an operating model, not a one-time project.
NHIMG editorial — based on content published by JumpCloud: phased Zero Trust rollout guidance for scaling access control
By the numbers:
- According to Gartner, only 16% of organizations have Zero Trust protections covering most 75% or more of their systems, users, and infrastructure.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
Questions worth separating out
Q: How should security teams phase a Zero Trust rollout without losing momentum?
A: Start with controls that reduce immediate risk and are easy to standardise, such as MFA, admin account removal, and least privilege.
Q: Why do Zero Trust programmes often stall after the first few wins?
A: They stall when teams confuse partial control adoption with operational maturity.
Q: What breaks when Zero Trust only covers login and privileged access?
A: Security gaps remain in applications, cloud services, and machine identities that are not subject to the same verification discipline.
Practitioner guidance
- Sequence control rollout by risk boundary Start with MFA, least privilege, and admin account removal, then expand to conditional access and lifecycle automation only after the baseline is stable across core systems.
- Extend policy coverage beyond login Map which applications, cloud services, and machine identities still rely on static access rules, then bring them under consistent conditional access and review workflows.
- Automate provisioning and deprovisioning Tie joiner, mover, and leaver workflows to identity sources so access removal happens at the same speed as access creation, including for service accounts and shared credentials.
What's in the full article
JumpCloud's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step phased rollout guidance for foundational, contextual, and optimisation stages.
- Specific control examples for MFA, conditional access, and provisioning workflows across environments.
- Practical framing for reducing friction while expanding Zero Trust coverage.
- The source article's downloadable playbook and readiness checklist for teams assessing current state.
👉 Read JumpCloud's analysis of phased Zero Trust rollout for security teams →
Zero trust rollout phases: what IAM teams need to prioritise?
Explore further
12/06/2026 9:05 am
Phased Zero Trust is really a governance model for control sequencing. The article’s core message is not that Zero Trust is hard, but that progress fails when organisations try to cover everything at once without a sequencing discipline. That is why early wins often stop at MFA and admin access while broader identity governance remains inconsistent. The practitioner lesson is that rollout order is itself a security decision.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Another finding from the same research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
A question worth separating out:
Q: How do access reviews fit into a scalable Zero Trust programme?
A: Access reviews are the maintenance layer that prevents controls from becoming stale. They should be tied to provisioning, deprovisioning, entitlement changes, and policy exceptions so the programme reflects current business reality. Without that cadence, Zero Trust degrades into a set of static controls that look strong on paper but drift operationally.
👉 Read our full editorial: Phased zero trust rollout is the key to scaling access control
